Provide an explicit MI evidence integration path for the composed server

kilo commented

2026-10-31 19:33:53 +00:00

Member

Foundry integration discovery: at SR 209f7d39f3ecebbd1b98b11d7c44c63192fe50a4, scarcity_router/control_server.py constructs the control plane without an MI consumer configuration, and the Dockerfile installs SR without the MI extra. The MI consumer delivered by #176 is intentionally an explicit-input library seam; MI #19's installed receipt is synthetic library interoperability, not composed-server activation. This is an integration capability gap, not a claim that #176 was defective.

Please define and implement a source-owned, opt-in server composition path if appropriate, preserving standalone operation, exact scope/model bindings and independently trusted artifact references, fail-closed authorization, retained-cut behavior and provenance. Specify safe artifact custody/update semantics; an artifact digest alone does not authenticate a publisher. Do not infer missing channel/configuration/effort or freshness for the current selected source. Demonstrate installed authenticated server consumption and failure cases with pinned compatible revisions. Coordinate downstream acceptance in Creatidy/foundry#1; #227 remains the separate composed-acceptance track.

Foundry integration discovery: at SR `209f7d39f3ecebbd1b98b11d7c44c63192fe50a4`, `scarcity_router/control_server.py` constructs the control plane without an MI consumer configuration, and the Dockerfile installs SR without the MI extra. The MI consumer delivered by #176 is intentionally an explicit-input library seam; MI #19's installed receipt is synthetic library interoperability, not composed-server activation. This is an integration capability gap, not a claim that #176 was defective. Please define and implement a source-owned, opt-in server composition path if appropriate, preserving standalone operation, exact scope/model bindings and independently trusted artifact references, fail-closed authorization, retained-cut behavior and provenance. Specify safe artifact custody/update semantics; an artifact digest alone does not authenticate a publisher. Do not infer missing channel/configuration/effort or freshness for the current selected source. Demonstrate installed authenticated server consumption and failure cases with pinned compatible revisions. Coordinate downstream acceptance in https://forgejo.creatidy.com/Creatidy/foundry/issues/1; #227 remains the separate composed-acceptance track.

kilo referenced this issue from Creatidy/foundry

2026-10-31 19:33:59 +00:00

Establish first secure SR–MI installed integration #1

kilo referenced this issue from Creatidy/foundry

2026-10-31 20:37:44 +00:00

Correct bootstrap publication and integration status #2

kilo referenced this issue

2026-10-31 22:06:49 +00:00

Reconcile standalone and Foundry architecture and deployment guidance #239

kilo commented

2026-10-31 22:47:16 +00:00

Author

Member

Implementation started from freshly fetched develop 209f7d39f3ecebbd1b98b11d7c44c63192fe50a4 on issue-238-mi-server, isolated from the original #224 checkout and unmerged PR #240. #240 was independently approved but remains proposed, not integrated; no Phase A source is copied. Existing exact-pinned MI extra, MIConsumer atomic slot, MIAdmission, route decision receipts and authenticated machine endpoint are available; server composition currently discards RouteDecision.mi_use, and the gateway constructs RouteRequest without MI. Work must preserve private authorization and persist enough retained artifacts for restart/replay without an extra database. No live evidence or positive Z.ai applicability is assumed.

Implementation started from freshly fetched `develop` `209f7d39f3ecebbd1b98b11d7c44c63192fe50a4` on `issue-238-mi-server`, isolated from the original #224 checkout and unmerged PR #240. #240 was independently approved but remains proposed, not integrated; no Phase A source is copied. Existing exact-pinned MI extra, `MIConsumer` atomic slot, `MIAdmission`, route decision receipts and authenticated machine endpoint are available; server composition currently discards `RouteDecision.mi_use`, and the gateway constructs `RouteRequest` without MI. Work must preserve private authorization and persist enough retained artifacts for restart/replay without an extra database. No live evidence or positive Z.ai applicability is assumed.

kilo commented

2026-10-31 23:45:28 +00:00

Author

Member

Implementation in progress on issue-238-mi-server at base 209f7d39f3ecebbd1b98b11d7c44c63192fe50a4; no PR/approval yet. Installed-wheel synthetic acceptance starts the authenticated composed server with the pinned optional MI dependency and verifies a trusted-cut utilization reference and retained receipt. Focused MI, store migration, type and package checks passed. Two full runs exposed (1) corrected schema/guardrail expectations and (2) worker-continuation availability failures with MI disabled: separate strict/parallel cases got 503 unavailable rather than their expected 502. The full continuation class passed in isolation; tests now wait for their actual live continuation prerequisite before each subcase without changing expected outcomes. Reconnection as the root cause is plausible but not established. A full rerun is required; no full PASS claimed. Retained evidence is synthetic, not source-owner-reviewed or live-provider evidence.

Implementation in progress on `issue-238-mi-server` at base `209f7d39f3ecebbd1b98b11d7c44c63192fe50a4`; no PR/approval yet. Installed-wheel synthetic acceptance starts the authenticated composed server with the pinned optional MI dependency and verifies a trusted-cut utilization reference and retained receipt. Focused MI, store migration, type and package checks passed. Two full runs exposed (1) corrected schema/guardrail expectations and (2) worker-continuation availability failures with MI disabled: separate strict/parallel cases got 503 unavailable rather than their expected 502. The full continuation class passed in isolation; tests now wait for their actual live continuation prerequisite before each subcase without changing expected outcomes. Reconnection as the root cause is plausible but not established. A full rerun is required; no full PASS claimed. Retained evidence is synthetic, not source-owner-reviewed or live-provider evidence.

adrian.tkacz referenced this issue from a commit

2026-10-31 23:59:34 +00:00

Compose trusted MI admission into server (#238)

kilo referenced this issue

2026-10-31 23:59:39 +00:00

Compose trusted MI admission into server (#238) #241

adrian.tkacz referenced this issue from a commit

2026-11-01 00:21:15 +00:00

Bind MI activation to trusted configuration (#238)

kilo commented

2026-11-01 00:28:53 +00:00

Author

Member

Proposed in PR #241 at 916a74350e61c7b262fe328f20f29d2d9db25966, base 209f7d39f3ecebbd1b98b11d7c44c63192fe50a4. Fresh independent security/correctness review #2 approved with no findings after remediation of #1; full gate passed 3,196 tests/18 skips and basedpyright, package-check and synthetic installed authenticated server acceptance passed. Both PR and issue remain open; no merge authority was exercised. Installed acceptance loads a trusted synthetic cut and retains an exact utilization reference with no eligible discovered source. It is not positive live-provider applicability, source-owner review, or downstream installed acceptance; these remain separate evidence gates.

Proposed in PR #241 at `916a74350e61c7b262fe328f20f29d2d9db25966`, base `209f7d39f3ecebbd1b98b11d7c44c63192fe50a4`. Fresh independent security/correctness review #2 approved with no findings after remediation of #1; full gate passed 3,196 tests/18 skips and basedpyright, package-check and synthetic installed authenticated server acceptance passed. Both PR and issue remain open; no merge authority was exercised. Installed acceptance loads a trusted synthetic cut and retains an exact utilization reference with no eligible discovered source. It is not positive live-provider applicability, source-owner review, or downstream installed acceptance; these remain separate evidence gates.

adrian.tkacz referenced this issue from a commit

2026-11-01 07:40:45 +00:00

Prepare offline MI install dependencies (#238)

kilo referenced this issue from a commit

2026-11-01 07:57:20 +00:00

Merge pull request 'Compose trusted MI admission into server (#238)' (#241) from issue-238-mi-server into develop

kilo closed this issue

2026-11-01 07:57:33 +00:00

kilo commented

2026-11-01 07:57:42 +00:00

Author

Member

Integrated by owner-authorized Forgejo merge PR #241 at 0493ed2b1892be6df0f96fb227fc96c68186e229; actual integrated tree 94404947f45ef8bb947c9f9adaf37420de1d8207 matches the fully validated combined tree. Exact-head CI #3418 passed; independent review #3 approved without findings at HEAD cb7a155ea17938d6164d54f71995e97f5cd5bcb0 and base 89aaba452283c5cf05d698201d0a7b7087712c71. Installed MI evidence remains synthetic and does not imply live-provider or source-owner acceptance.

Integrated by owner-authorized Forgejo merge PR #241 at `0493ed2b1892be6df0f96fb227fc96c68186e229`; actual integrated tree `94404947f45ef8bb947c9f9adaf37420de1d8207` matches the fully validated combined tree. Exact-head CI #3418 passed; independent review #3 approved without findings at HEAD `cb7a155ea17938d6164d54f71995e97f5cd5bcb0` and base `89aaba452283c5cf05d698201d0a7b7087712c71`. Installed MI evidence remains synthetic and does not imply live-provider or source-owner acceptance.

Rows
Columns

Provide an explicit MI evidence integration path for the composed server #238